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1.  Introduction 


Network  traffic  has  been  discovered  to  be  self-similar  over  time  under  numerous  circumstances 
in  commercial  networks  (Leland  et  al.,  1994;  Willinger  et  ab,  1995).  These  are  high-capacity 
networks  primarily  operating  under  the  Transmission  Control  Protocol/Internet  Protocol 
(TCP/IP)  or  asynchronous  transfer  mode  packet  systems  (Park  et  ah,  1996;  Park  and  Willinger, 
2000).  Some  tactical  radio  traffic  data  exist  from  the  Fire  Support  Team  Force  Development 
Testing  and  Experimentation  II  (FIST  FDT&E  II).  In  addition,  the  U.S.  Army  Research 
Eaboratory  (ARE)  has  performed  analyses  of  tactical  communications  protocols  in  the  laboratory 
using  controlled  radio  networks  driven  by  Poisson-generated  traffic.  These  channels  are  of 
extremely  low  throughput  by  commercial  standards,  by  factors  of  5000  or  more,  and  the  tactical 
communications  protocols  are  different  from  those  based  on  the  TCP/IP  suite. 

This  study  examines  the  properties  of  self-similar  traffic  using  the  EIST  EDT&E  II  data  and 
synthetic  traffic  streams  generated  using  Paxson’s  fast  Eourier  transform  of  fractional  Gaussian 
noise  (PET  EGN)  method  (Paxson,  1995).  The  field  data  and  the  generated  traffic  data  are 
analyzed  using  several  tools,  which  are  discussed  in  the  sections  that  follow. 


2.  Analytical  Methods 


2,1  Statistical  Methods 

Several  tests  have  been  described  in  the  literature  (Crovella  and  Bestavros,  1997;  Grossglauser 
and  Bolot,  1999;  Eeland  et  ah,  1994;  Park  et  ah,  1996;  Park  and  Willinger,  2000)  and  employed 
to  analyze  self-similar  traffic.  To  date,  only  the  variance-time  plot  test  has  been  applied.  This, 
in  graphical  form,  is  a  method  for  determining  whether  the  traffic  stream  is  multifractal.  Tests 
that  analyze  a  traffic  stream  and  determine  a  numerical  value  based  on  the  assumption  of 
monofractal  composition  may  be  in  error  if  the  stream  is  multifractal. 

The  sensitivity  of  the  variance-time  method  is  investigated  by  generating  synthetic  traffic  with 
multiple  self-similar  components.  The  statistical  tool  used  to  analyze  the  traffic  is  a  software 
program  written  to  determine  the  variance  of  sample  means  vs.  the  sample  size  (the  “variance¬ 
time  plot”).  Eor  events  that  are  independent  over  time,  this  tool  is  based  on  the  relation 

Var  {X)=  <j^  n\  (1) 

Eor  events  that  are  correlated  over  time  and  also  display  scale  invariance, 

Var  {X)=  <j^  (Beran,  1994).  (2) 
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If  the  variance  of  the  sample  means  is  plotted  against  the  sample  size  on  a  log-log  graph,  the 
slope  -(3  of  the  resultant  line  is  -1  for  independent  events.  The  factor  /3  is  related  to  the  Hurst 
parameter  (//),  a  heuristic  measure  of  the  degree  of  self-similarity,  by  the  expression 

13=  2(1 -H).  (3) 

//typically  varies  between  0.5  and  1.0.  A  value  of  //=  0.5  corresponds  to  a  sequence  of  events 
that  is  not  correlated  over  time;  H>  0.5  indicates  increasing  degrees  of  self-similarity.  One 
attractive  feature  of  this  graphical  technique  is  that  it  may  reveal  multifractal  behavior.  As  the 
degree  of  self-similarity  increases,  the  traffic  stream  becomes  bursty  over  all  time  scales.  Under 
certain  conditions,  this  allows  streams  of  data  with  more  than  one  component  to  reveal  the 
existence  of  multiple  degrees  of  self-similarity  in  the  traffic. 

The  question  arises  over  just  what  the  variance-time  plot  reveals.  The  literature  on  self-similar 
traffic  treats  three  types  of  self-similarity:  (1)  strict  self-similarity,  where  the  traffic  exhibits  a 
set  scale  invariance  that  defines  fractal  behavior,  (2)  second-order  self-similarity,  and 
(3)  asymptotic  second-order  self-similarity.  The  latter  two  involve  the  behavior  of  the 
autocorrelation  function,  a  second-order  function.  Autocorrelation  implies  long-range  order  or 
dependence.  The  problem  is  that  there  are  self-similar  processes  that  are  not  long-range 
dependent  and  long-range  dependent  processes  that  are  not  self-similar.  However,  for 
asymptotic  second-order  self-similar  processes  and  if// >  0.5,  self-similarity  implies  long-range 
dependence  and  vice-versa  (Park  and  Willinger,  2000).  In  this  case,  the  synthetic  traffic  is 
generated  from  a  self-similar  process,  fractional  Gaussian  noise,  rather  than  being  merely 
second-order  self-similar. 

The  tool  as  written  chose  the  initial  aggregation  size  randomly,  within  limits.  If  the  randomly 
chosen  aggregation  size  is  >1/6  of  the  total  number  of  sampled  traffic  points  or  <1/10  of  the  total 
number  of  points,  another  aggregation  size  is  drawn.*  The  start  point  is  also  randomly  chosen. 
This  usually  leads  to  discarding  “orphan”  points  at  the  beginning  and  end  of  the  traffic  stream, 
but  the  sample  is  chosen  large  enough  that  it  is  felt  this  could  be  disregarded.  It  is  hoped,  in  this 
way,  to  compensate  for  any  systematic  variation  in  the  traffic.  The  aggregation  size  is  then 
decreased  by  a  chosen  factor,  and  the  calculation  is  repeated.  It  might  be  noted  that  this  leads  to 
smaller  and  smaller  numbers  of  orphan  points.  When  the  aggregation  size  reaches  a  chosen 
factor,  usually  <8  points,  the  calculation  is  terminated. 

The  results  obtained  using  this  tool  are  discussed  in  sections  3. 1-3.2  and  appendix  A. 

2,2  Synthetic  Traffic  Generator 

Schuler’s  program  (Schuler,  1995),  based  on  the  work  of  Paxson  (1995),  was  used  to  generate 
streams  of  synthetic  traffic  with  controlled  properties.  The  program  option  of  generating  a  real 


These  values  were  chosen  arbitrarily  to  reduce  scatter  arising  from  the  availability  of  only  a  few  samples  or  a  few  points 
within  the  samples.  Other  values  would  work  as  well. 
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traffic  trace  was  used.  Traffie  streams  with  differing  means,  varianees,  and  degrees  of  self- 
similarity,  as  reflected  in  H,  were  generated.  The  traffie  streams  eould  be  of  any  size  but, 
typically,  were  over  a  million  (2  )  inerements.  Larger  traffie  streams  eould  easily  be  generated 
beeause  the  program  is  very  fast,  but  a  million  time  inerements  seemed  adequate. 

There  are  at  least  two  ways  of  imposing  two  or  more  self-similar  proeesses  on  a  traffie  stream. 
One  is  to  generate  a  single  traffie  stream  by  sueeessively  imposing  two  or  more  proeesses  that, 
individually,  impose  self-similarity.  Another  is  to  merge  two  or  more  streams  of  traffie,  eaeh 
with  a  degree  of  self-similarity.  The  latter  was  seleeted  in  this  ease,  sinee  all  of  the  tools  to  do  so 
were  on  hand.  Traffie  streams  with  multiple  fraetal  properties  were  generated  by  merging  two 
streams  with  differing  values  of  H.  These  were  used  to  estimate  the  ability  of  the  statistieal  tool 
to  distinguish  between  traffie  streams  of  differing  properties. 

The  merging  of  two  streams  may  represent  the  ease  of  a  network  with  streams  from  two 
independent  sourees  of  differing  self-similarity  characteristics.  A  traffic  stream  generated  by  a 
series  of  proeesses,  each  of  which,  acting  alone,  would  generate  a  stream  with  one  set  of  self- 
similar  eharaeteristies,  might  represent  an  open  system  intereonneet  (OSI)  staek  with  a 
heavy-tailed  file-size  distribution  and  a  TCP  that  also  imposes  self-similarity  on  the  traffic 
stream.  The  latter  may  be  done  in  future  researeh,  sinee  it  is  a  very  plausible  representation  of 
taetieal  network  traffie.  For  simplieity,  the  analysis  has  so  far  been  restrieted  to  the  simpler 
ease — the  merger  of  two  independent  traffie  streams.  No  attempt  has  been  made  to  impose 
carrier  sense  multiple  aeeess  on  the  merging  proeess;  this  amounts  to  an  assumption  of  a  link 
running  at  a  suffieiently  low  fraetion  of  the  possible  throughput  sueh  that  eollisions  are  unlikely. 
This  is  not  a  realistic  representation  of  a  taetieal  network  but  is  a  simple  way  to  begin  the 
analysis. 

It  is  highly  desirable  to  model  the  imposition  of  multiple  self-similar  proeesses  on  a  single  traffie 
stream;  the  Optimized  Network  Engineering  Tool  (OPNET)*  provides  exeellent  software  for  this, 
sinee  it  requires  explieitly  modeling  the  OSI  staek.  It  is  also  highly  desirable  to  model  CSMA  in 
heavily  loaded  networks  and  to  have  multiple  traffie  streams  of  differing  eharaeteristies.  Again, 
OPNET  may  be  a  very  useful  tool  for  this. 

The  output  from  the  traffie  generator  was  analyzed  using  the  varianee-time  plot  diseussed 
previously.  The  output  was  reasonably  well-behaved,  but  there  are  several  eautions  in  the  use  of 
the  Paxson  model.  The  first  is  that  it  is  an  approximation.  Aeeording  to  Paxson,  the  output  traee 
produeed  by  his  methodology  is  only  approximately  self-similar,  even  though  the  output  traee 
passes  four  tests  for  self-similarity: 

1 .  the  varianee  of  the  sample  means  vs.  sample  size  (the  “varianee-time  plot”), 

2.  Beran’s  goodness-of-fit  test. 


OPNET  is  a  registered  trademark  of  OPNET  Technologies,  Inc.,  Bethesda,  MD. 
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3.  Whittle’s  estimator,  and 

4.  normality  or  near-normality  of  the  marginal  distribution  of  the  sample. 

Paxson  refers  to  this  as  the  “quacks  like  a  duck”  phenomenon:  if  it  walks  like  a  duck  and  quacks 
like  a  duck,  one  may  as  well  call  it  a  duck.  In  that  case,  if  the  data  act  self-similar,  then  for 
engineering  purposes  they  may  be  treated  as  such  (Paxson,  1995). 

The  output  trace  from  the  traffic  generator  produced  for  this  effort  was  tested  using  the  variance¬ 
time  plot.  The  data  were  well  behaved;  the  estimated  H  of  the  resulting  traffic  stream  was 
approximately  that  of  the  input  value  of  H.  Visual  inspection  of  the  goodness  of  fit  should  be 
validated  by  more  rigorous  statistical  methods. 

In  addition,  the  traffic  generator  lists  intermediate  and  final  values  of  the  traffic  stream  mean  and 
variance  and  cautions  that  they  may  vary  from  the  input  values.  The  final  output  values  for  the 
mean  and  variance  were  found  to  replicate  the  input  values  exactly.  In  addition,  when  the  traffic 
streams  were  analyzed  by  a  separate  program  to  calculate  the  mean  and  variance,  the  mean  and 
variance  of  the  generated  output  trace  were  found  to  be  in  very  good  agreement  with  the  input 
values.  The  other  traffic  parameters  also  appeared  to  be  well  behaved.  This  is  discussed  below. 
Although  the  synthetic  traffic  was  well  behaved,  future  work  should  include  new  methods  of 
generating  the  synthetic  traffic  to  check  this  assumption. 


3.  Data  Analysis 


The  ARL  has  performed  a  number  of  statistically  controlled  tactical  radio  network  experiments. 
The  baseline  experiment  and  its  results  are  fully  described  elsewhere  (Kaste  et  ah,  1992).  This 
report  focuses  on  exploring  the  self-similar  properties  of  tactical  communications  data  collected 
during  a  1984  field  experiment  and  synthetically  generated  laboratory  data. 

3.1  Synthetic  Traffic 

To  gain  some  insight  into  the  phenomenon  of  self-similarity  and  to  estimate  the  utility  of  the 
variance-time  tool,  synthetic  traffic  was  generated  as  described  previously.  Several  observations 
are  in  order. 

The  tool  should  respond  to  some  degree  to  the  input  mean  value  of  the  traffic  streams  because 
the  variance  is  a  second-order  phenomenon.  This  can  be  seen  in  appendix  A,  figures  A- 1 
through  A-3.  For  example,  figure  A- 1  shows  uncorrelated  traffic  with  means  differing  by  20: 1 . 
There  is  a  substantial  difference.  Figure  A-2  illustrates  moderately  correlated  traffic  with  means 
varying  by  2: 1 .  There  is  little  impact  in  that  case.  Streams  with  fixed  values  of  H  and  variance 
but  differing  values  of  the  overall  (input)  mean  were  plotted  together.  The  plots  were  similar, 
increasing  only  slowly  as  the  sample  mean  increased,  for  values  of  //=  0.5,  0.7,  and  0.9. 
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In  addition,  plots  were  made  of  streams  with  the  same  values  of  the  input  mean  and  varianee  but 
differing  values  of  H  (figures  1  and  2).  Sinee  this  test  is  sensitive  to  the  long-range  eorrelation  of 
traffie,  it  is  not  surprising  that  traffie  with  higher  values  of  //should  be  differentiated  at  longer 
time  seales,  provided  the  long-term  memory  is  strong  enough.  Likewise,  sinee  self-similarity 
aeeompanies  burstiness,  it  is  not  surprising  that  traffic  with  a  higher  degree  of  self-similarity 
should  be  differentiated  from  traffic  with  little  or  no  self-similarity  at  lower  time  scales  as  well. 
The  implication  is  that,  if  the  time  scale  can  be  sufficiently  extended,  traffic  streams  with 
components  of  differing  self-similarity  should  be  discernable  with  this  graphical  method. 


Sample  size  (log-seale) 


Figure  1.  Variance-time  plot  of  synthetic  traffic  streams  with  differing  H. 

Traffic  streams  of  differing  degrees  of  self-similarity  were  generated  as  discussed  using  Paxson’s 
scheme  for  approximating  self-similar  traffic,  which  uses  an  FFT  FGN.  Traffic  streams  with 
H=  0.5  (uncorrelated),  // =  0.7  (moderately  correlated),  and//=  0.9  (highly  correlated)  were 
generated  and  are  plotted  in  figure  1.  Initially,  the  traces  were  1,048,576  arbitrary  time  steps 
(2  )  with  traffic  expressed  in  terms  of  arbitrary  units.  These  traffic  streams  had  input  mean 
values  of  1000  and  variances  of  300.  That  is,  from  the  standpoint  of  an  analysis,  ignoring  self¬ 
similarity,  the  traffic  streams  are  nominally  of  identical  statistical  characteristics.  As  can  be  seen 
in  figure  1,  the  variance  of  the  sample  means  vs.  sample  size  of  the  synthetic  traffic  indicates  that 
the  characteristics  of  the  traffic  streams  are  radically  different. 
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Figure  2.  Variance-time  plot  of  synthetic  traffic  streams  with  differing  Ff  merged. 

Figure  2  indicates  that  when  streams  with  similar  input  means  and  input  variances  but  differing 
Hs  are  summed  pairwise,  the  trace  of  the  summed  traffic  is  essentially  indistinguishable  by 
inspection  from  the  trace  of  the  more  self-similar  traffic  stream.  That  is,  the  contribution  to  the 
variance  of  the  sample  means  (a  measure  of  burstiness)  from  the  more  self-similar  traffic,  under 
these  conditions,  masks  all  other  contributions  from  all  other  components  of  the  traffic.  It  is  also 
clear  that  a  traffic  stream  with  H=0.5,  but  a  substantially  greater  mean  and  variance,  might  well 
show  up  in  the  analysis  of  the  summed  stream.  This  is  illustrated  in  figure  3.  Indeed,  analysis  of 
the  field  test  data  indicates  such  a  phenomenon  might  have  taken  place  in  two  of  the  exercises. 

In  this  variance-time  plot,  three  synthetic  traffic  streams  are  shown.  One  stream  {H=  0.5,  input 
mean  =  100,000,  and  input  variance  =  10,000)  represents  the  background  traffic.  Another  stream 
{H=  0.9,  input  mean  =  500,  and  input  variance  =  300)  represents  a  highly  variable  but  highly 
correlated  traffic  stream,  perhaps,  of  a  network  scan.  The  merged  stream  has  a  mean  of  100,500 
and  a  variance  essentially  the  same  as  the  larger  stream.  The  merged  stream  shows  a  pronounced 
“knee”  in  the  curve,  since  the  second-order  characteristics  of  the  traffic  stream  with  //=  0.9 
dominate  the  curve  for  larger  sample  sizes  and  the  characteristics  of  the  uncorrelated  stream 
dominate  the  curve  for  smaller  sample  sizes.  Note  this  assumes  the  long-term  memory  of  the  H 
=  0.9  stream  is  quite  strong.  For  background  traffic  with  H  =  0.5  but  lower  variance,  the 
characteristics  of  the  merged  stream  are  indistinguishable  by  inspection  from  the  highly  self¬ 
similar  stream,  but  these  curves  are  not  shown.  Many  permutations  of  the  traffic  characteristics 
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Figure  3.  Variance-time  plot  showing  effects  of  increased  mean  and  variance  on  merged  traffic 
streams. 


are  possible,  including  those  where  the  smaller  stream  would  be  undetectable  by  graphical 
methods  but  possibly  detectable  by  more  subtle  statistical  analysis  and  those  where  the  smaller 
stream  would  be  simply  undetectable. 

3.2  Field  Test  Data 

The  three  traffic  streams  from  the  field  exercise  are  plotted  in  figure  4.  From  the  variance-time 
plot,  the  traffic  clearly  exhibits  characteristics  of  self-similarity.  Approximate  fits  to  the  data  are 
shown;  all  three  traffic  streams  are  quite  different  from  the  reference  line,  with  the  slope 
indicating  // =  0.5.  Interestingly,  the  traffic  exhibits  a  considerable  degree  of  self-similarity, 
with  the  appearance  of//'-  0.9.  Even  more  interesting  are  the  traffic  streams,  corresponding  to 
the  first  week  of  the  field  exercise  (FEX  1),  which  appear  to  consist  of  two  components:  one 
with  H  -0.5  and  the  other  with  H  -0.9.  The  stream  produced  by  the  third  week  of  testing 
(FEX  3)  also  appears  to  exhibit  two  components.  The  other,  from  the  second  week  (FEX  2), 
does  not  appear  to  do  so.  Since  the  traffic  was  generated  under  similar  conditions  and 
constraints,  it  is  not  clear  why  the  streams  would  differ  or  what  phenomena  produced  the 
differences. 
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Figure  4.  FIST  FDT&E  II  data  with  reference  line,  slope  =  -1  (H=0.5). 


4.  Discussion 


There  are  a  number  of  reasons  to  suspeet  that  the  field  test  data  would  demonstrate  some  degree 
of  self-similarity.  Some  of  these  phenomena  might  also  reasonably  be  expected  to  apply  to  the 
results  of  a  laboratory  test.  Possible  phenomena  of  interest  in  the  field  test  data  are  the  reliable 
transport  mechanism  and  file  size  distribution. 

Traffic  using  the  TCP/IP  suite  has  been  reported  as  self-similar  in  contrast  to  User  Datagram 
Protocol  traffic,  which  shows  little  long-range  dependence  (Park  et  ah,  1996).  This  is 
reasonable.  TCP/IP,  in  imposing  a  reliability  and  control  mechanism,  produces  a  series  of 
messages  to  ensure  delivery.  Thus,  a  message  triggers  predictable  traffic  into  the  future.  It  has 
been  stated  that  retransmission  mechanisms  may  make  even  a  Poisson  distribution  traffic  model 
appear  self-similar  (Tsybakov  and  Georganas,  1998). 

The  Tactical  Fire  Direction  System  (TACFIRE)  protocol  acts  to  a  degree  as  a  reliable  transport 
protocol.  The  TACFIRE  protocol  requires  responses  from  the  message  recipients  similar  to  the 
SYN  and  ACK  processes  of  the  TCP/IP.  Several  possible  factors  that  may  impose  self-similarity 
have  been  enumerated  in  the  literature,  among  them  being  the  effects  of  queued  and  buffered 
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traffic  (addition  of  flow  and  reliability  mechanisms),  user  “think  time,”  and  the  implications 
from  the  ON-OFF  model,  as  deseribed  in  (Grossglauser  and  Bolot,  1999;  Willinger  et  ah,  1997). 

Parenthetically,  it  should  be  noted  that  the  series  of  ACK  messages  typieal  of  the  TCP/IP  are  also 
found  in  the  X.25  protocol,  the  staple  underlying  protoeol  of  the  Mobile  Subseriber  Equipment 
(MSE),  the  military  cellular  radio  system.  The  implieation  is  that  the  packet  network  based  on 
MSE  may  also  exhibit  self-similar  behavior,  with  its  own  eharacteristic  time  scale.  This  was  not 
a  factor  in  the  ARE  experiments  but  may  well  be  a  factor  in  actual  tactical  traffic.  The  field  test 
data  described  in  Appendix  B  do  not  involve  an  MSE  and,  therefore,  do  not  involve  an  X.25  link 
either. 

Any  self-similarity  aetually  generated  by  these  phenomena  in  the  laboratory  test  data  may  be 
hard  to  find  beeause  of  low  message  rates  that,  in  spite  of  being  low  compared  to  eommereial 
applications,  still  loaded  the  net  sufficiently  to  preclude  a  greater  range  of  traffie  rates.  The 
laboratory  test  data  were  collected  aeross  a  range  of  message  sizes,  but  these  messages  were 
independent  and  not  part  of  a  train  of  packets  composing  a  single  large  file.  This  may  be  a  factor 
in  tactical  networks. 

A  file-size  distribution  weighted  with  a  tail  of  large  files  (heavy-tailed  file-size  distributions)  has 
been  demonstrated  to  impose  self-similarity  on  network  traffie  (Eeland  et  ah,  1994;  Peha,  1997). 
It  is  likely  that  file-size  distributions  differ  from  place  to  place  in  the  tactical  net,  at  least  at  the 
present  time.  At  the  small-unit  level,  each  combat  vehicle  has  an  applique  computer,  and 
updates  to  the  situation  maps  oeeur  frequently.  These  map  updates  are  vector-based  and,  henee, 
shorter  than  bitmaps.  Other  messages  sueh  as  ealls  for  fire  are  preformatted  and  short;  file  sizes 
in  the  field  test  data  included  numerous  preformatted  messages  of  20  and  52  bytes. 

At  the  headquarters  level,  the  situation  is  more  complex.  In  a  tactical  headquarters  today,  there 
is  a  host  of  preformatted  messages  sueh  as  Maneuver  Control  System  (MCS)  data.  These  are 
individually  short,  but  in  a  sense,  MCS  updates  could  be  considered  a  very  long  message  (fide), 
since  a  partieular  update  will  surely  be  followed  by  another  later  on  that  is  part  of  the  same 
sequence.  This  also  implies  a  contribution  to  autocorrelation  over  long  time  periods.  Other 
command-related  traffic  could  involve  pictures,  maps,  and  planning  doeuments.  The  traffic  at 
different  levels  of  a  tactieal  network  might  well  be  dominated  by  different  file-size  distributions. 
If  self-similarity  oeeurs  at  the  two  levels,  there  might  well  be  different  time  scales  or  levels  of 
self-similarity  for  the  traffic  streams,  hence,  different  fraetal  properties.  If  traffie  from  two  levels 
shares  the  same  trunk,  the  net  traffic  would  be  a  superposition  of  traffic  with  two  or  more  time 
seales  (multifraetal),  but  relative  eharacteristies  of  the  two  streams  might  mask  all  but  a  time 
scale  assoeiated  with  dominant  traffie.  Recent  efforts  to  deliver  imagery  from  satellites  and  air 
reconnaissanee  to  units  at  the  lowest  level  indieate  that  substantial  file  sizes  may  well  extend  to 
all  areas  of  the  tactieal  net,  further  eomplieating  the  issue. 
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5.  Implications  of  Multifractal  Behavior 


5.1  Implications  for  Current  Work 

There  is  ongoing  work  to  investigate  multifraetal  properties  of  network  traffie.  This  work  is, 
however,  on  eommereial  traffie,  not  taotieal.  An  unusually  taeit  assumption  made  by  the 
investigators  is  that  the  traffie  does  not  ehange  its  fundamental  properties  (i.e.,  stationarity) 
during  the  time  intervals  analyzed  and  the  time  the  data  are  grouped.  The  emerging  trends 
outlined  in  this  report  indieate  that  taotieal  network  traffie  may,  indeed,  be  multifraetal.  The 
oombat  oyole  may  well  produoe  traffie  that  is  emphatioally  not  stationary  in  its  properties. 

An  example  is  defense,  during  a  pause  in  the  operational  tempo,  shifting  to  the  assault;  the  times 
would  be  the  most  demanding  and  oruoial  to  oombat  suooess.  Network  designs  or  speoifioations 
generated  as  a  result  of  the  applioation  of  the  results  of  researoh  on  eommereial  traffie  may  well 
lead  to  massive  inadequaoies  of  network  oapability  when  the  taotieal  networks  in  their  turn 
violate  stationarity. 

5.2  Implications  for  Intrusion  Detection 

The  possibility  of  differentiating  between  two  or  more  streams  of  traffie  of  differing  levels  of 
self-similarity  may  make  it  possible  to  deteot  the  presenoe  of  a  new,  alien  traffie  stream  in  a 
network.  An  example  might  be  an  attaok  or  reoonnaissanoe  soan  of  a  network.  If  the  soan  were 
to  interrogate  many  different  hosts  in  a  partioular  blook  of  IP  addresses,  switehing  baek  and  forth 
from  one  host  to  another  to  avoid  raising  suspieions  by  dwelling  on  a  partioular  host  and  not 
presenting  a  regular  pattern  by  interrogating  a  set  pattern  of  ports,  the  aotual  traffie  to  all  of  the 
targets  might  be  distinguishable  as  suoh  over  the  network.  It  is  neoessary  to  measure  the  self¬ 
similarity  and  other  oharaoteristios  of  traffie  produoed  by  several  attaok  tools  and  reoonnaissanoe 
tools  (soanners)  and  to  measure  the  properties  of  a  network  as  time  and  oircumstanoes  ehange.  A 
possible  example  of  suoh  a  soenario  is  illustrated  in  figure  4.  In  this  varianoe-time  plot,  several 
traffie  streams  are  shown.  In  partioular,  a  typioal  traffie  stream  with  //=  0.5  merged  with  a 
traffie  stream  with  H  =  0.9  should  present  a  olear  indioation  of  a  ehange  to  the  flow  oomposed  of 
two  distinot  streams,  even  though  the  overall  (input)  mean  of  the  traffie  stream  with  H  =  0.5  is 
200  times  greater  than  the  other.  The  usual  network  traffie  should  be  oharaoterized  hy  H>  0.5, 
but  the  message  flow  from  a  network  soan  might  be  even  larger. 

5.3  Implications  for  Analysis 

A  method  for  disoerning  traffie  oharaoteristios  of  multifraetal  traffie  must  be  obtained. 
Wavelet-based  methods  have  been  used  by  other  researohers  and  seem  to  hold  promise  for  this 
work  as  well  (Park  and  Willinger,  2000). 
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6.  Summary 


Field  test  data  gathered  during  the  FIST  FDT&E  II  indieated  that  a  low  bandwidth  taetieal  radio 
network  generated  traffie  exhibiting  the  eharaeteristies  of  self-similarity.  This  was  not 
unexpeeted.  Furthermore,  in  two  of  the  traffie  streams,  there  appeared  to  be  evidenee  of  two 
eomponents  of  self-similarity  eorresponding  to  near-zero  eorrelation  and  highly  eorrelated.  The 
reasons  were  not  elear. 


11 


7.  References 


Beran,  J.  Statistics  for  Long-Memory  Processes.  Monographs  on  Statistics  and  Applied 
Probability  61;  Chapman  &  Hall/CRC:  New  York,  1994. 

Crovella,  M.  E.;  Bestavros,  A.  Self- Similarity  in  World  Wide  Web  Traffic:  Evidence  and 
Possible  Causes.  lEEE/ACM  Trans.  Networking  1997,  5  (1),  pp  835-846. 

Grossglauser,  M.;  Bolot,  J.-C.  On  the  Relevance  of  Eong-Range  Dependence  in  Network 
Traffic.  lEEE/ACM  Trans.  Networking  1999,  7  (5),  pp  629-640. 

Kaste,  V.  A.  T.;  Brodeen,  A.  E.  M.;  Broome,  B.  D.  An  Experiment  to  Examine  Protocol 
Performance  Over  Combat  Net  Radios;  BRL-MR-3978;  U.S.  Army  Ballistic  Research 
Eaboratory:  Aberdeen  Proving  Ground,  MD,  June  1992. 

Eeland,  W.;  Taqqu,  M.  S.;  Willinger,  W.;  Wilson,  D.  V.  On  the  Self-Similar  Nature  of  Ethernet 
Traffic  (Extended  Version).  lEEE/ACM  Trans.  Networking  1994,  2  (1),  pp  1-15. 

Park,  K.;  Willinger,  W.  Self-Similar  Network  Traffic  and  Performance  Evaluation;  Wiley  & 
Sons:  New  York,  2000. 

Park,  K.;  Kim,  G.;  Crovella,  M.  E.  On  the  Relationship  Between  Eile  Sizes,  Transport  Protoeols, 
and  Self-Similar  Network  Traffie.  Proceedings  of  the  Eourth  International  Conference  on 
Network  Protocols,  Columbus,  OH,  1996;  pp  171-180. 

Paxson,  V.  Past  Approximation  of  Self-Similar  Network  Traffic;  EBE-36750;  Eawrence 
Berkeley  Eaboratory:  University  of  California  (Berkeley),  April  1995. 

Peha,  J.  M.  Protoeols  Can  Make  Traffic  Appear  Self-Similar  (Expansion  of  research  published 
as  Retrans  mission  Meehanisms  and  Self-Similar  Traffic  Models).  Proceedings  of  the  1997 
lEEE/ACM/SCS  Communication  Networks  and  Distributed  Systems  Modeling  and 
Simulation  Conference,  Phoenix,  AZ,  1997;  pp  47-52. 

Sehuler,  C.  Research  Institute  for  Open  Communieation  Systems,  GMD  EOKUS. 

http://ita.ee.lbl.gov/html/contrib/fft_fgn_e.htm  (accessed  18  April  2002),  Hardenbergplatz  2, 
D- 10623  Berlin,  Germany,  August  1995. 


12 


Tsybakov,  B.;  Georganas,  N.  D.  Self-Similar  Processes  in  Communications  Networks.  IEEE 
Trans.  Inform.  Theory  1998,  44  (5),  1713-1725. 

Willinger,  W.;  Taqqu,  M.  S.;  Sherman,  R.;  Wilson,  D.  V.  Self-Similarity  Through  High- 

Variability:  Statistical  Analysis  of  Ethernet  LAN  Traffic  at  the  Source  Level.  lEEE/ACM 
Trans.  Networking  1997,  5,  71-86. 

Willinger,  W.;  Taqqu,  M.  S.;  Leland,  W.  E.;  Wilson,  D.  V.  Self-Similarity  in  High-Speed  Packet 
Traffic:  Analysis  and  Modeling  of  Ethernet  Traffic  Measurements.  Stat  Sci.  1995, 10  (4), 
67-85. 


13 


Appendix  A.  Variance-Time  Plots  of  Synthetic  Traffic 


Note  that  the  plots  in  figure  A-1  fall  in  approximately  the  same  region  over  a  considerable  range 
of  input  means  (500,  600,  1000,  and  10,000  units)  and  a  fixed  input  variance  of  300  units. 


Figure  A- 1 .  Variance-time  plot  of  synthetic  traffic  streams  with  H=0.5 
(uncorrelated). 


Figure  A-2  indicates  that  for  moderately  correlated  traffic  (H=  0.7),  with  a  fixed  input  variance 
of  300  units  and  input  means  ranging  from  500  to  1000  units,  the  plots  fall  approximately  on  the 
same  line. 


Figure  A-2.  Variance-time  plot  of  synthetic  traffic  streams  with  H  =  0.7 
(moderately  correlated). 
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The  behavior  of  the  plot  in  figure  A-3  is  similar  to  the  behavior  of  the  plot  in  figure  A-1 .  The 
input  varianee  in  this  plot  has  also  been  fixed  to  300  units.  Note  the  oecasional  outlying  points. 
These  are  probably  artifacts  of  the  small  sample  sizes.  Scatter  due  to  large  sample  size  may  also 
occur  as  the  number  of  samples  becomes  small.  Truncation  of  the  analysis  program  is  set  to  a 
cell  size  of  <8. 


Figure  A-3.  Variance-time  plot  of  synthetic  traffic  streams  with  0.9  (highly 
correlated). 
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Appendix  B.  Description  of  Fire  Support  Team  Force  Development  Testing 
and  Experimentation  II  (FIST  FDT&E  II) 


The  field  test  data  were  gathered  during  the  FIST  FDT&E  II.  This  test  was  eondueted  and 
extensively  documented  by  the  Human  Engineering  Eaboratory  and  the  U.S.  Army  Ballistic 
Research  Eaboratory.^  A  test  involved  a  mechanized  infantry  task  force  composed  of  two 

mechanized  infantry  companies  and  one  armor  company.  The  task  force  was  one-third  of  the 
Eield  Artillery  assets  of  a  maneuver  brigade.  The  experiment  was  run  in  three  iterations  at 
Et.  Riley,  KS.  Two  iterations  were  Scenario-Oriented  Recurring  Evaluation  System  Europe 
V-based  scenario  driven  field  exercises  (EEX),  while  the  third  was  a  free-play  force-on-force 
exercise.  The  networks  tested  were  devoted  to  digital  traffic  generated  by  digital  message 
devices,  using  preformatted  messages,  over  analog  fixed  frequency  voice  radios  (AN/PRC  77). 
The  layout  of  the  network  is  shown  in  figure  B-1. 

Data  were  collected  manually  and  by  use  of  traffic  recorded  from  a  central  point.  The  taped  data 
were  digitized  and  inserted  into  a  message  collection  and  recording  system.  The  recorded  traffic 
was  frequency  shift  keyed,  and  the  traffic  was  converted  to  RS  232  ASCII  format  by  use  of  “bit 
box,”  modems,  which  allow  Tactical  Eire  Direction  System  (TACEIRE)  hardware  to 
communicate  with  commercial  computers.  Messages  were  sorted  by  fire  mission  into  three 
categories:  (1)  messages  grouped  by  fire  mission  number,  (2)  unknown  messages,  and  (3) 
messages  known  but  not  part  of  a  fire  mission.  The  data  were  sent  to  the  Eield  Artillery  School 
at  Et.  Sill,  OK,  for  in-depth  analysis  and  conversion  into  a  comprehensive  database.  The  data 
analyzed  here  are  raw  traffic,  not  sorted  or  otherwise  reduced  by  purpose. 

Data  were  collected  for  three  networks:  (1)  the  Company  Eire  Control  Net  (CEC  Net),  (2)  the 
Mortar  Eire  Direction  Net  (MED  Net),  and  (3)  the  Eire  Direction  Net  (ED  Net).  It  is  not  clear 
which  data  (EEX  1,  2,  or  3)  for  a  data  stream  used  here  came  from  which  net,  though  they  were 
apparently  interleaved  by  time.  A  total  of  344  hr  of  data  was  collected,  22  hr  of  which  were 
from  noncontrolled  parts  of  the  test  and  not  digitized.  The  other  322  hr  of  data  were  categorized, 
as  shown  in  table  B-1 . 

The  breakdown  into  message  type  is  extremely  interesting,  as  shown  in  table  B-2.  The  variable 
format  (VE)  message  traffic  over  the  CEC3  and  MED  nets  is  surprising  because  these  nets 
contained  digital  devices  capable  of  producing  only  fixed  format  messages.  Kaste  et  al.^ 
speculated  that  players  with  devices  capable  of  generating  VE  messages  were  probably  on  the 
wrong  communications  nets.  This  is  reasonable.  Unlike  a  voice  net,  at  that  time,  there  was  no 


'  Kaste,  V.  A.  T.;  Brodeen,  D.  C.;  Winner,  W.  A.  Description  of  the  Digital  Data  Collected  From  FIST  FDT&E  II; 
BRL-TR-2676;  U.S.  Army  Ballistic  Research  Laboratory:  Aberdeen  Proving  Ground,  MD,  September  1985. 

2 

Grynovicki,  J.  O.;  Smith,  J.  H.  Experimental  Design  and  Analysis  for  the  FIST  Force  Development  Testing  and 
Experimentation  IT,  BRL-MR-3474;  U.S.  Army  Ballistic  Research  Laboratory:  Aberdeen  Proving  Ground,  MD,  October  1985. 
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Table  B-1.  Digital  message  traffic  collected.' 


Nets 

Good 

Messages 

Unintelligible 

Messages 

Percent 

Unintelligible 

Total 

Messages 

CFCl 

10,103 

746 

7 

10,849 

CFC2 

9268 

1341 

13 

10,609 

CFC3 

11,839 

1398 

11 

13,237 

FDl 

97,880 

2631 

3 

100,511 

FD2 

24,552 

1430 

6 

25,982 

MFD 

5780 

3651 

39 

9431 

Totals 

159,422 

11,197 

7 

170,619 
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Table  B-2.  Good  messages  by  type. ' 


Nets 

ACKs 

Fixed  Format 

Variable  Format 

Total  Messages 

CFCl 

4569 

5534 

0 

10,103 

CFC2 

3578 

5690 

0 

9268 

CFC3 

5503 

4069 

2267 

11,839 

FDl 

44,512 

33,411 

19,957 

97,880 

FD2 

10,688 

118 

13,746 

24,552 

MFD 

2381 

3233 

76 

5780 

Totals 

71,231 

52,145 

36,046 

159,422 

authentication  or  error-checking  procedure  for  digital  networks  as  there  is  in  the  voice  radio 
procedure  (e.g.,  Bravo  Tango  seven-four,  this  is  Golf  Sierra  six;  you  do  not  belong  on  this  net, 
over).  Also,  all  but  four  of  the  messages  on  the  CFC3  and  MFD  nets  occurred  during  the 
free-play  FEX  3;  the  other  four  occurred  during  the  noncontrolled  portion  of  FEX  2.  That  could 
account  for  a  contribution  of  self-similarity  in  EEX  3;  unfortunately,  there  is  only  a  hint  of  such 
behavior  (see  figure  4). 

VE  messages  can  be  lengthy  (100-1500  characters)  as  opposed  to  fixed  format  messages 
(48  characters).  The  message  length  does  not  include  synchronization  characters  or  the 
preamble.  It  may  be  that  the  message  traffic  generated  by  VE  messages  introduces  a  degree  of 
autocorrelation:  if  the  message  is  being  transmitted,  there  is  a  good  chance  it  is  still  being 
transmitted  some  time  from  now.  It  is,  however,  more  likely  that  the  self-similarity  is  largely  an 
artifact  of  the  reliable  transport  function  of  the  TACEIRE  protocol. 
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NO.  OF 

COPIES  ORGANIZATION 


NO.  OF 

COPIES  ORGANIZATION 


ABERDEEN  PROVING  GROUND 

I  DIR  USARL 

AMSRD  ARE  Cl  OK  TP  (BLDG  4600) 


I  COMMANDING  GENERAL 
US  ARMY  MATERIEL  CMD 
AMCRDA  TF 
5001  EISENHOWER  AVE 
ALEXANDRIA  VA  22333-0001 

1  INST  FOR  ADVNCD  TCHNLGY 

THE  UNIV  OF  TEXAS 
AT  AUSTIN 

3925  W  BRAKER  LN  STE  400 
AUSTIN  TX  78759-5316 

1  US  MILITARY  ACADEMY 

MATH  SCI  CTR  EXCELLENCE 
MADN  MATH 
THAYER  HALL 
WEST  POINT  NY  10996-1786 

1  DIRECTOR 

US  ARMY  RESEARCH  LAB 
AMSRD  ARE  CS  IS  R 
2800  POWDER  MILL  RD 
ADELPHI  MD  20783-1197 

3  DIRECTOR 

US  ARMY  RESEARCH  LAB 
AMSRD  ARE  Cl  OK  TL 
2800  POWDER  MILL  RD 
ADELPHI  MD  20783-1197 

3  DIRECTOR 

US  ARMY  RESEARCH  LAB 
AMSRD  ARE  CS  IS  T 
2800  POWDER  MILL  RD 
ADELPHI  MD  20783-1197 


1  DEFENSE  TECHNICAL 
(PDF  INFORMATION  CENTER 
Only)  DTIC  OCA 

8725  JOHN  J  KINGMAN  RD 
STE  0944 

FT  BEL  VOIR  VA  22060-6218 
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NO.  OF 

COPIES  ORGANIZATION 


ABERDEEN  PROVING  GROUND 

25  DIR  USARL 

AMSRD  ARE  Cl  CT 
M  C  LOPEZ 
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